How to Set a strictly 30-minute overdue Session?

I often ask a question: "How to set a 30-minute overdue Session ?". The first one is: Set the Session expiration time, that is, the session. gc_maxlifetime is incorrect because: 1. first, PHP runs the session gc with a certain probability, that is, the session. gc _

I often ask a question: "How to set a 30-minute overdue Session ?". The first one is: Set the Session expiration time, that is, the session. gc_maxlifetime is incorrect because: 1. first, PHP runs the session gc with a certain probability, that is, the session. gc _

I often ask a question: "How to set a 30-minute overdue Session ?".

The first answer:

The most common answer is: Set the Session expiration time, that is, session. gc_maxlifetime. This answer is incorrect because:

1. First, PHP runs the session gc with a certain probability, that is, session. gc_probability and session. gc_pisor? A small probability of Session Gc in PHP). The default values are 1 and 100, that is, there is a 1% chance. When PHP starts a Session, run Session gc. it cannot be guaranteed that it will expire in 30 minutes.

2. What about setting a high probability of cleaning? Why? Because PHP uses the modification time of the stat Session file to determine whether the file has expired. If this probability is increased, the performance will be reduced, PHP uses a "one" file to store Session variables related to a Session. Suppose I set a Session variable a = 1 five minutes ago, five minutes later, another Seesion variable B = 2 is set. The modification time of this Session file is the time when B is added, so a cannot be at 30 minutes, cleared. the third reason is as follows.

3. The default PHP (Linux as an example) is to use/tmp as the default Session storage directory, which is also described in the Manual as follows:

Note: If different scripts have different session. gc_maxlifetime values but share session data stored in the same place, the script with the minimum value clears the data. In this case, use this command with session. save_path.

That is to say, if two applications do not specify their own independent save_path, one is set to 2 minutes (assumed as A), and the other is set to 30 minutes (assumed as B ), when Session gc of A is run, Session files of application B will be deleted at the same time.

Therefore, the first method is not "completely strict.

The second answer:

Set the carrier of the Session ID, and the Cookie expiration time, that is, session. cookie_lifetime. This answer is also incorrect, for the following reasons:

This expiration only indicates that the Cookie expires. In other words, the difference between the Cookie and the Session is that the Session expires on the server and the Cookie expires on the client (browser, even if you set Cookie expiration, this can only ensure that the Cookie (including Session ID) will not be sent when the standard browser expires. If you construct a request, you can also use the value of this Session ID.

The third answer:

Use memcache, redis, and so on.

Fourth answer:

1. Set the Cookie expiration time to 30 minutes, and set the Session life time to 30 minutes.

2. Add Time stamp for each Session value.

3. Determine the timestamp before each access.

I believe this 30-minute expiration feature will be used in many places. In fact, I think the fourth option is quite reliable.

Original article address: how to set a strictly 30-minute overdue Session? Thanks to the original author for sharing.